linux-kernel - Re: [PATCH] drm/amdgpu: prevent BO_HANDLES error from being overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d9a3fee4-bb14-4162-95b1-06177d0a9949@damsy.net>
Date: Wed, 9 Oct 2024 10:22:44 +0200
From: Pierre-Eric Pelloux-Prayer <pierre-eric@...sy.net>
To: Mohammed Anees <pvmohammedanees2003@...il.com>,
 amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org
Cc: Alex Deucher <alexander.deucher@....com>,
 Christian König <christian.koenig@....com>,
 Xinhui Pan <Xinhui.Pan@....com>, David Airlie <airlied@...il.com>,
 Simona Vetter <simona@...ll.ch>,
 Srinivasan Shanmugam <srinivasan.shanmugam@....com>,
 David Wu <David.Wu3@....com>, Felix Kuehling <felix.kuehling@....com>
Subject: Re: [PATCH] drm/amdgpu: prevent BO_HANDLES error from being
 overwritten

Hi,

Le 05/10/2024 à 01:59, Mohammed Anees a écrit :
> Before this patch, if multiple BO_HANDLES chunks were submitted,
> the error -EINVAL would be correctly set but could be overwritten
> by the return value from amdgpu_cs_p1_bo_handles(). This patch
> ensures that once an error condition is detected, the function
> returns immediately, avoiding the overwriting of the error code.
> 
> Signed-off-by: Mohammed Anees <pvmohammedanees2003@...il.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> index 1e475eb01417..543db0df9a31 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
> @@ -266,8 +266,9 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
>   			/* Only a single BO list is allowed to simplify handling. */
>   			if (p->bo_list)
>   				ret = -EINVAL;
> +			else
> +				ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);
>   
> -			ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);

My bad, I've merged the wrong version of the patch.

That being said, I think it'd be nicer to follow the same pattern as the other checks and do:

    if (p->bo_list)
       goto free_partial_kdata;

Since "ret" is initialized to -EINVAL already.

Also can you add a reference to the broken commit in the commit message?
Something like:

Fixes: fec5f8e8c6bcf83 ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit")

Thanks,
Pierre-Eric

>   			if (ret)
>   				goto free_partial_kdata;
>   			break;